July 2024 - openSUSE Bugs - openSUSE Mailing Lists

[Bug 1220727] New: VUL-0: CVE-2023-51774: rubygem-json-jwt: JWE can sometimes be used to bypass JSON:JWT.decode
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1220727 Bug ID: 1220727 Summary: VUL-0: CVE-2023-51774: rubygem-json-jwt: JWE can sometimes be used to bypass JSON:JWT.decode Classification: openSUSE Product: openSUSE Distribution Version: Leap 15.6 Hardware: Other URL: https://smash.suse.de/issue/395627/ OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Security Assignee: security-team(a)suse.de Reporter: smash_bz(a)suse.de QA Contact: security-team(a)suse.de CC: abergmann(a)suse.com Target Milestone: --- Found By: Security Response Team Blocker: --- The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack. For example, JWE can sometimes be used to bypass JSON::JWT.decode. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-51774 https://www.cve.org/CVERecord?id=CVE-2023-51774 https://github.com/P3ngu1nW/CVE_Request/blob/main/novjson-jwt.md -- You are receiving this mail because: You are on the CC list for the bug.

1 3

[Bug 1228441] New: python-spyder-notebook fails to build
by bugzilla_noreply＠suse.com 07 Jan '25

07 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1228441 Bug ID: 1228441 Summary: python-spyder-notebook fails to build Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: All Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: code(a)bnavigator.de Reporter: bwiedemann(a)suse.com QA Contact: qa-bugs(a)suse.de CC: mcepl(a)suse.com Target Milestone: --- Found By: Development Blocker: --- While working on reproducible builds for openSUSE, I found that our python-spyder-notebook fails to build. Steps To Reproduce: osc co openSUSE:Factory/python-spyder-notebook && cd $_ osc build --noservice --vm-type=kvm --clean -j4 standard Actual Results: /var/tmp/rpm-tmp.xbK78N: line 85: 2912 Segmentation fault PYTHONPATH=${PYTHONPATH:+$PYTHONPATH:}/home/abuild/rpmbuild/BUILDROOT/python-spyder-notebook-0.5.1-0.x86_64/usr/lib/python3.11/site-packages PYTHONDONTWRITEBYTECODE=1 pytest-3.11 --ignore=_build.python3 -v Full build log: https://rb.zq1.de/other/python-spyder-notebook/build.log -- You are receiving this mail because: You are on the CC list for the bug.

1 1

[Bug 1228176] New: Missing gstreamer-plugins-good-32bit package
by bugzilla_noreply＠suse.com 06 Jan '25

06 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1228176 Bug ID: 1228176 Summary: Missing gstreamer-plugins-good-32bit package Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: obs.coke518(a)passinbox.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Wine needs this package to play videos in some 32bit games. The following error is logged: winegstreamer: failed to create deinterlace, are 32-bit GStreamer "good" plugins installed? -- You are receiving this mail because: You are on the CC list for the bug.

1 2

[Bug 1220571] New: [META] Packages failing because GCC 14+ treats some warnings as errors
by bugzilla_noreply＠suse.com 06 Jan '25

06 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1220571 Bug ID: 1220571 Summary: [META] Packages failing because GCC 14+ treats some warnings as errors Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: mjambor(a)suse.com Reporter: mjambor(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- GCC 14 treats the following situations, which were only warnings before, as errors: -Werror=implicit-int -Werror=implicit-function-declaration -Werror=declaration-missing-parameter-type -Werror=return-mismatch -Werror=int-conversion -Werror=incompatible-pointer-types More details about all of these cases together with the most common ways of addressing them and some associated pitfalls is available at https://gcc.gnu.org/gcc-14/porting_to.html For the record, clang has taken a similar step since clang 16, see for example https://www.redhat.com/en/blog/new-warnings-and-errors-clang-16 The preferred method of dealing with these issues is of course fixing the code. Other distributions have shared patches from their porting efforts on relevant upstream mailing lists and bug trackers, Gentoo and RedHat are perhaps most active in this regard, so you can have a look at what they did for their packages at: - https://bugs.gentoo.org/showdependencytree.cgi?id=870412&hide_resolved=0 - https://gitlab.com/fweimer-rh/fedora-modernc/ In case there is for some reason not possible to fix the code, or at least to fix it in time for adoption of GCC 14, it is possible to turn these back to warnings by adding to the compiler options one of the following: -std=gnu89, -std=c89, or -fpermissive. (Especially if you use -fpermissive as a temporary workaround with intention to fix the underlying issues later, I'd suggest leaving the particular bug opened until it is done so.) -- You are receiving this mail because: You are on the CC list for the bug.

1 115

[Bug 1212947] New: Disable fbdev userspace interfaces and programs
by bugzilla_noreply＠suse.com 06 Jan '25

06 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1212947 Bug ID: 1212947 Summary: Disable fbdev userspace interfaces and programs Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Basesystem Assignee: screening-team-bugs(a)suse.de Reporter: tzimmermann(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- We want to remove fbdev from kernel and userspace as far as possible. Linux 6.6 will allow us to disable fbdev's userspace interfaces, most noteably /dev/fb*. Enable this feature in the TW kernel. Framebuffer support has been an endless source of bugs. Not giving userspace access to it's internals and framebuffer memory will close a possible entry point for all sorts of malware. Please note that the framebuffer console is implemented entirely within the kernel and will not be affected by this change. -- You are receiving this mail because: You are on the CC list for the bug.

1 18

[Bug 1227129] New: chromium GPU errors
by bugzilla_noreply＠suse.com 05 Jan '25

05 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1227129 Bug ID: 1227129 Summary: chromium GPU errors Classification: openSUSE Product: openSUSE Tumbleweed Version: Slowroll Hardware: x86-64 OS: openSUSE Tumbleweed Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: elatllat(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Fresh Tumbleweed GNOME install in KVM. Chromium hangs before any GUI shows up. # chromium libva error: /usr/lib64/dri/virtio_gpu_drv_video.so init failed [28135:28135:0626/115134.122807:ERROR:viz_main_impl.cc(166)] Exiting GPU process due to errors during initialization # /usr/bin/chromium --enable-features=UseOzonePlatform --ozone-platform=wayland --force-dark-mode --enable-features=WebUIDarkMode libEGL warning: egl: failed to create dri2 screen libEGL warning: egl: failed to create dri2 screen libEGL warning: NEEDS EXTENSION: falling back to kms\_swrast libva error: /usr/lib64/dri/virtio\_gpu\_drv\_video.so init failed \[28226:28226:0626/115232.941494:ERROR:viz\_main\_impl.cc(166)\] Exiting GPU process due to errors during initialization -- You are receiving this mail because: You are on the CC list for the bug.

1 21

[Bug 1222815] New: Performance CoPilot 6 is not starting due to missing pmlogger_daily.timer
by bugzilla_noreply＠suse.com 03 Jan '25

03 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1222815 Bug ID: 1222815 Summary: Performance CoPilot 6 is not starting due to missing pmlogger_daily.timer Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: dmueller(a)suse.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- just installing pcp and pmlogger leads to: # systemctl start pmlogger Failed to start pmlogger.service: Unit pmlogger_daily.timer not found. this unit is currently in pcp-zeroconf. however pmlogger.service is in pcp (main package). if zeroconf is supposed to be optional, then the pmlogger_daily.timer dependency is supposed to be made optional. otherwise the timer needs to be moved into the main package (like it appears to be upstream) -- You are receiving this mail because: You are on the CC list for the bug.

1 7

[Bug 1228593] New: thinkpad x13s aarch64 continue reset during grub2 load kernel
by bugzilla_noreply＠suse.com 03 Jan '25

03 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1228593 Bug ID: 1228593 Summary: thinkpad x13s aarch64 continue reset during grub2 load kernel Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: aarch64 OS: openSUSE Tumbleweed Status: NEW Severity: Major Priority: P5 - None Component: Bootloader Assignee: screening-team-bugs(a)suse.de Reporter: macromarship(a)gmail.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- I just bought a thinkpad x13s aarch64. Following HCL:suse I have successfully installed latest version. And I have copied the dtb file to system_drv partition as page requested. But after grub2 load kernel, the computer continues reset. About 7-8 times failed then 1 success. This makes I am afraid to reboot computer because next time will take more tries to come in. I notice the UEFI version is 1.60 or 1.70, which is a higher version than 1.58. Upgrade your UEFI firmware to the newer versions which can support LINUX boot v1.49 or later versions. The latest version tested: v1.58 I have read all the tickets on this website. Can any help guide how to resolve this? Thanks. -- You are receiving this mail because: You are on the CC list for the bug.

1 17

[Bug 1217920] New: QT_IM_MODULE is always set on plasma 5.27.9
by bugzilla_noreply＠suse.com 03 Jan '25

03 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1217920 Bug ID: 1217920 Summary: QT_IM_MODULE is always set on plasma 5.27.9 Classification: openSUSE Product: openSUSE Tumbleweed Version: Current Hardware: Other OS: Other Status: NEW Severity: Normal Priority: P5 - None Component: Other Assignee: screening-team-bugs(a)suse.de Reporter: i(a)xuzhao.net QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- According to the fcitx5 on wayland wiki page: https://fcitx-im.org/wiki/Using_Fcitx_5_on_Wayland QT_IM_MODULE and GTK_IM_MODULE and SDL_IM_MODULE are not suggested to be set on fcitx5+plasma_wayland>5.27. However, after I install fcitx5 on opensuse 20231117, these environment variables are still being set by default. Is there a way that I can disable setting these environment variables on startup? -- You are receiving this mail because: You are on the CC list for the bug.

1 8

[Bug 1226405] New: Nautilus crash when opening multiple mp3 files
by bugzilla_noreply＠suse.com 03 Jan '25

03 Jan '25

https://bugzilla.suse.com/show_bug.cgi?id=1226405 Bug ID: 1226405 Summary: Nautilus crash when opening multiple mp3 files Classification: openSUSE Product: openSUSE Aeon Version: Current Hardware: x86-64 OS: Other Status: NEW Severity: Minor Priority: P5 - None Component: Desktop Environment Assignee: rbrown(a)suse.com Reporter: thiagomagalhaes07(a)yahoo.com QA Contact: qa-bugs(a)suse.de Target Milestone: --- Found By: --- Blocker: --- Created attachment 875506 --> https://bugzilla.suse.com/attachment.cgi?id=875506&action=edit Crash example Nautilus 46.2 crash when one tries to open multiple musics in some apps. The crash happens when one tries to open 29 musics in "Clapper", "Celluloid", "Music" and "Amberol", but works using "Rhythmbox" and "VLC". (all mentioned apps in current flathub versions) -- You are receiving this mail because: You are on the CC list for the bug.

1 1